0

I am taking a intro to reversing course. After learning patching we got a home work to find the flag and write a writeup on how we did it. Part of the riddle is to figure out where exactly to find the flag. I was thinking maybe the pdf with the instructions on the home work has the flag in it. Is there a way to convert it to a executable format PE, so i can analyse it with IDA? If not what else can I do to find the flag if all I have is a pdf

Improve this question
3
  • what would the executable do?
    – jsotola
    Commented Feb 16 at 5:20
  • Do the PDF instructions state where to download the binary from? Since it's a reversing course and not a file forensics course the flag should be in some executable binary that you download from somewhere.
    – julian ♦
    Commented Feb 16 at 15:43
  • I suggest you use a tool like pdfStreamDumper.exe to examine the PDF file for 'malicious` code. The tool will list all the streams in the PDF file.
    – fpmurphy
    Commented Feb 18 at 2:26

1 Answer 1

Reset to default
0

There is no conversion from pdf to PE and such conversion makes little sense.

A pdf can contain embedded javascript which can be defined as executable code in the broad sense.

There are some useful tools for analyzing pdf files here:

https://stackoverflow.com/questions/10220497/extract-javascript-from-malicious-pdf

A good starting point would be opening the file in a hex editor and looking for clues, maybe hidden instructions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.